CVE-2026-43018Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 95118dd4edfec950898a00180c6f998df0a6406d builds before 59eecf0ffde15670e6a5e10c47be67f73d843b20; 95118dd4edfec950898a00180c6f998df0a6406d builds before 5fb69e1eeea9d6cba80517e9f058b56b34bc3a81; 95118dd4edfec950898a00180c6f998df0a6406d builds before 7cadb03be37e761130edb153544fe0770a842b19; 95118dd4edfec950898a00180c6f998df0a6406d builds before 1d0bdbfe3e91c11f0a704c52443a9446a10d699c; from 95118dd4edfec950898a00180c6f998df0a6406d before ea3cd36d7382d5f8309df04c275d20df139ed42c; from 95118dd4edfec950898a00180c6f998df0a6406d before b255531b27da336571411248c2a72a350662bd09 | CNA record |
linux linux_kernel linux:linux_kernel | from 5.17 before 6.1.168; from 6.2 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 7.0; 7.0; 7.0; and 3 more ranges | NVD |
References
- https://git.kernel.org/stable/c/59eecf0ffde15670e6a5e10c47be67f73d843b20patch
- https://git.kernel.org/stable/c/5fb69e1eeea9d6cba80517e9f058b56b34bc3a81patch
- https://git.kernel.org/stable/c/7cadb03be37e761130edb153544fe0770a842b19patch
- https://git.kernel.org/stable/c/1d0bdbfe3e91c11f0a704c52443a9446a10d699cpatch
- https://git.kernel.org/stable/c/ea3cd36d7382d5f8309df04c275d20df139ed42cpatch
- https://git.kernel.org/stable/c/b255531b27da336571411248c2a72a350662bd09patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.